seokmo-yoo-dev opened a new pull request, #23393: URL: https://github.com/apache/kafka/pull/23393
### Summary `LoginManager` is cached by the JAAS configuration, the login class, the login callback class and the `sasl.*` configs, but not by the caller's class loader. Two deployments in one JVM with the same configuration therefore share a `Login`. For SASL/OAUTHBEARER that never recovers. The refresh thread of `ExpiringCredentialRefreshingLogin` inherits the context class loader of whichever deployment acquired first. When that deployment stops the reference count does not reach zero, `login.close()` never runs, and every later refresh fails with `IllegalStateException: Trying to access closed classloader`. Once the token expires the broker rejects any client that has to re-authenticate. Adding the context class loader to the key gives each deployment its own `LoginManager`, so the count reaches zero when a deployment stops and the refresh thread ends with it. Applications with a single class loader, brokers included, are unaffected, since the key is then identical for every caller. KAFKA-21043 has the full failure sequence and the history of the cache key. ### Testing `LoginManagerTest.testLoginManagerWithDifferentContextClassLoaders` covers distinct instances across class loaders, sharing within one, and disposal when one deployment releases every reference while another keeps an identical JAAS configuration. Reverting the key change makes it fail. ``` ./gradlew :clients:test --tests '*LoginManagerTest' ./gradlew :clients:checkstyleMain :clients:checkstyleTest :clients:spotlessCheck ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
